INTERNET-DRAFT Michael P. Armijo
-<draft-ietf-ldapext-locate-06.txt> Levon Esibov
-November 13, 2001 Paul Leach
-Expires: May 13, 2002 Microsoft Corporation
+<draft-ietf-ldapext-locate-08.txt> Levon Esibov
+June 5, 2002 Paul Leach
+Expires: December 5, 2002 Microsoft Corporation
R.L. Morgan
University of Washington
http://www.ietf.org/shadow.html.
Distribution of this memo is unlimited. It is filed as <draft-
- ietf-ldapext-locate-04.txt>, and expires on February 25, 2001.
+ ietf-ldapext-locate-08.txt>, and expires on December 5, 2002.
Please send comments to the authors.
Copyright Notice
Armijo, Esibov, Leach and Morgan [Page 1]
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
reasonable because many objects of interest are named with domain
names, and use of domain-name-based DNs is becoming common.
+ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+ "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+ document are to be interpreted as described in RFC 2119 [9].
+
+
+
+
+
+
+Armijo, Esibov, Leach and Morgan [Page 2]
+
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
2. Mapping Distinguished Names into Domain Names
DNs cannot be converted into a domain name. Converted DNs result
in a fully qualified domain name.
-Armijo, Esibov, Leach and Morgan [Page 2]
-
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
-
-
The output domain name is initially empty. The DN is processed in
right-to-left order (i.e., beginning with the first RDN in the
The client would convert the DC components as defined above into
DNS name:
- example.net.
+ example.net
The determined DNS name will be submitted as a DNS query using the
algorithm defined in section 3.
appropriate server from multiple servers according to the algorithm
described in [5]. The name of this record has the following format:
- _<Service>._<Proto>.<Domain>
+ _<Service>._<Proto>.<Domain>.
where <Service> is "ldap", and <Proto> is "tcp". <Domain> is the
domain name formed by converting the DN of a naming context mastered
-
-
-
-
-
-
-
Armijo, Esibov, Leach and Morgan [Page 3]
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
-
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
Presence of such records enables clients to find the LDAP servers
that satisfy the requested criteria. The following is an example of
such a record:
- _ldap._tcp.example.net. IN SRV 0 0 389 phoenix.example.net.
+ _ldap._tcp.example.net. IN SRV 0 0 389 phoenix.example.net.
The set of returned records may contain multiple records in the case
where multiple LDAP servers serve the same domain. If there are no
portion of the constructed fully qualified domain name.
-
4. IANA Considerations
This document does not require any IANA actions.
intended to contact. See [7] for more information on security
threats and security mechanisms.
- The client MUST use the server hostname it used to open the LDAP
- connection as the value to compare against the server name as
- expressed in the server's certificate. The client MUST NOT use the
- server's canonical DNS name or any other derived form of name.
+ When using LDAP with TLS the client MUST check the server's name,
+ as described in section 3.6 of [RFC 2830]. As specified there, the
+ name the client checks for is the server's name before any
+ potentially insecure transformations, including the SRV record
+ lookup specified in this memo. Thus the name the client MUST check
+ for is the name obtained by doing the mapping step defined in
+ section 2 above. For example, if the DN "cn=John
+ Doe,ou=accounting,dc=example,dc=net" is converted to the DNS name
+ "example.net", the server's name MUST match "example.net".
This document describes a method that uses DNS SRV records to
discover LDAP servers. All security considerations related to DNS
SRV records are inherited by this document. See the security
considerations section in [5] for more details.
-
-
-
Armijo, Esibov, Leach and Morgan [Page 4]
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
6. References
"Authentication Methods for LDAP", RFC 2829, May 2000.
[8] Hodges, J., Morgan, R., Wahl, M., "Lightweight Directory Access
- Protocol (v3): Extension for Transport Layer Security", RFC 2830,
- May 2000.
-
+ Protocol (v3): Extension for Transport Layer Security",
+ RFC 2830, May 2000.
+ [9] Bradner, S., "Key words for use in RFCs to Indicate Requirement
+ Levels", BCP 14, RFC 2119, March 1997.
levone@microsoft.com
-
Armijo, Esibov, Leach and Morgan [Page 5]
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
RL "Bob" Morgan
University of Washington
Armijo, Esibov, Leach and Morgan [Page 6]
-INTERNET-DRAFT Discovering LDAP Services with DNS Novemeber 13, 2001
+INTERNET-DRAFT Discovering LDAP Services with DNS June 5, 2002
INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
10. Expiration Date
- This documentis filed as <draft-ietf-ldapext-locate-06.txt>, and
- expires May 13, 2002.
+ This document is filed as <draft-ietf-ldapext-locate-08.txt>, and
+ expires December 5, 2002.
Armijo, Esibov, Leach and Morgan [Page 7]
\ No newline at end of file
projects / openldap / blobdiff